Firestore Rules Occasional Permission Denied - firebase

Question

So I'm making a journaling app with Flutter that has journals and journal entries.
Here are my firestore rules that have been working for the most part:
rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
match /users/{userId} {
allow read, update, delete: if request.auth != null && request.auth.uid == userId;
allow create: if request.auth != null;
}
match /journals/{journal} {
allow read, update, delete: if resource.data.users.hasAny([request.auth.uid]);
allow create: if request.auth != null;
}
match /journalEntries/{journalEntry} {
allow read, update, delete: if request.auth.uid != null && get(/databases/$(database)/documents/journals/$(resource.data.journal)).data.users.hasAny([request.auth.uid]);
allow create: if request.auth != null;
}
}
}
The issue I run into happens about half the time when adding journals:
W/Firestore(31194): (24.0.1) [Firestore]: Listen for Query(target=Query(journalEntries where journal == GivKPhcnen8OmCDOcXs3 order by -dateCreated, -__name__);limitType=LIMIT_TO_FIRST) failed: Status{code=PERMISSION_DENIED, description=Missing or insufficient permissions., cause=null}
E/flutter (31194): [ERROR:flutter/lib/ui/ui_dart_state.cc(209)] Unhandled Exception: [cloud_firestore/permission-denied] The caller does not have permission to execute the specified operation.
To clarify, I add a journal document, and then immediately query all the journal entries for that journal, which there are none initially.
Everything works fine if I remove the "get(/databases/$(database)/documents/journals/$(resource.data.journal)).data.users.hasAny([request.auth.uid])" part in the rules but I need that for security. The only thing I can think of is that there is some race condition happening where firestore rules don't think the journal document has been created yet when I start querying the journal entries for the new journal.
Any ideas of what is going on?

Answer 1

Any ideas of what is going on?
Writing to the Firestore database is asynchronous. What's probably going on is that you try to read before the write operation is complete and therefore the security rule does not find the newly created journal document.
We don't see your code, but do you wait that the asynchronous write operation is complete before fetching the journalEntries collection?
In addition, remember that Firestore security rules are not filters. It means that your query to the journalEntries collection must filter the documents that have the user uid in the users array.